Skip to main content
← Back to playbooks

VulnOps Playbook

unreviewed

Implements a continuous Vulnerability Operations (VulnOps) function combining AI-driven static analysis, dynamic application testing, and third-party zero-day discovery with automated triage and remediation pipelines.

Author: cyberagents-exchange
License: MIT
Added: Apr 13, 2026
View on GitHub →

Agent Chain

  1. 1. Claude Code Security ↗

    AI-driven static analysis of first-party code — identifies logic flaws, broken access control, and complex vulnerabilities beyond pattern matching

    GitHub
  2. 2. Tenable Web App Scanning ↗

    Dynamic application security testing of running applications — catches auth bypasses, injection, and runtime vulnerabilities that static analysis misses

    GitHub
  3. 3. Tenable Hexa AI + Tenable One VM ↗

    Continuous zero-day discovery and exposure analysis across third-party software estate with AI-accelerated prioritization

    GitHub
  4. 4. Tenable Patch Management Agent

    Consolidates findings from all discovery stages, correlates with asset context, and executes prioritized automated remediation

    On Exchange
  5. 5. VulnOps Analyst Review

    Triage discipline checkpoint — human analyst reviews prioritized findings and approves remediation actions before deployment

    Manual Step

Integrations

AnthropicTenable

Tags

vulnopsshift-leftzero-daySASTDASTcontinuous-discovery

This playbook implements Priority Action 11 (“Stand Up VulnOps”) from the Cloud Security Alliance’s The “AI Vulnerability Storm”: Building a “Mythos-ready” Security Program strategy briefing (April 2026). It establishes a permanent Vulnerability Operations function — staffed and automated like DevOps, but for autonomous vulnerability research and remediation.

Coverage Model

VulnOps owns continuous discovery across your entire software estate:

  • First-party code (SAST): Claude Code Security provides AI-driven static analysis that reads and reasons about code like a human security researcher, catching complex vulnerabilities (business logic flaws, broken access control) that rule-based tools miss.
  • First-party code (DAST): Tenable Web App Scanning adds a dynamic assessment layer, testing applications while running to catch vulnerabilities that only manifest at runtime.
  • Third-party software: Tenable Hexa AI and Tenable One Vulnerability Management locate zero-day vulnerabilities in dependencies and deployed infrastructure, with AI-accelerated exposure prioritization.

Triage Discipline

Per CSA guidance, this playbook is designed around triage discipline from the start. The Tenable Patch Management Agent consolidates all findings into a single prioritized remediation queue before any action is taken. The human review checkpoint ensures remediation actions are approved before deployment — maintaining the human-in-the-loop that both the tools and the strategy demand.